fix(ci): harden GitHub Actions workflows (#275)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #275.

Warning

This changes when the workflow runs and what it can reach. Both triggers and permissions were rewritten in .github/workflows/ratbot.yml, .github/workflows/rust.yml. Read the diff before merging — either one can change what the workflow is able to do.

Targets dependabot/github_actions/actions-11bc0e91e6. Files changed:

• .github/workflows/ratbot.yml
• .github/workflows/rust.yml

Fixed by this PR:

• HIGH dangerous-triggers (zizmor) — .github/workflows/ratbot.yml:2
• HIGH unpinned-action (pinact) — .github/workflows/rust.yml:47
• HIGH unpinned-action (pinact) — .github/workflows/rust.yml:87
• MEDIUM excessive-permissions (zizmor) — .github/workflows/ratbot.yml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/ratbot.yml:6
• MEDIUM excessive-permissions (zizmor) — .github/workflows/rust.yml:75

This does not fix everything. 2 further finding(s) (2 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/ratbot.yml

job	granted	why
comment	contents: read, issues: write, pull-requests: write	actions/checkout needs contents: read; the github-script step calls issues.listComments/createComment/updateComment against the pull request, which requires write on pull-requests (and issues: write is listed because the issues REST namespace is the one being called) — reviewer may drop issues: write if only PR comments are ever posted.

.github/workflows/rust.yml

job	granted	why
check	contents: read	Only actions/checkout needs the token; the remaining steps run cargo nextest, copy webdriver configs and run just wasm-test locally — note the local ./.github/actions/setup composite action is not visible in this file, so a reviewer should confirm it does no API calls beyond checkout-level reads.

build was left as it is — The just wasm-publish-pr ratchet-web step runs a justfile recipe that is not in this file, so it is impossible to see whether it publishes to an external registry (no token needed), pushes to GitHub Packages (packages: write) or posts a PR preview comment (pull-requests: write); apart from that only checkout (contents: read) is evident.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.

[github-actions]

Code Metrics Report

  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Language              Files        Lines         Code     Comments       Blanks
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 TOML                      1           73           61            2           10
─────────────────────────────────────────────────────────────────────────────────
 Rust                     75        16523        14153          233         2137
 |- Markdown              34          349            0          277           72
 (Total)                            16872        14153          510         2209
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Total                    76        16945        14214          512         2219
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━